Securing MediaWiki using Centrale KU Leuven Login
About
MediaWikiShibboleth is a MediaWiki extension created by ULYSSIS to allow for login through the Central KU Leuven Login (Shibboleth). The extension disables editing and creating of (talk) pages by anonymous users, and requires Shibboleth authentication for account creation and login.
Prerequisites
Before installing, you need to have SSL and Shibboleth (Central KU Leuven Login) enabled on your domain.
- For instructions on how to get SSL: https://docs.ulyssis.org/Getting_SSL
- Information about requesting Shibboleth: https://docs.ulyssis.org/Shibboleth
Once you know everything is installed properly, you can proceed to install the extension.
Installation
First, download the latest release from github. Make sure to click the MediaWikiShibboleth.zip download button. Then, unzip the zip file in your <mediawiki installation folder>/extensions/ directory. Finally, add the following lines to your <mediawiki installation folder>/LocalSettings.php:
wfLoadExtension('MediaWikiShibboleth');
include 'extensions/MediaWikiShibboleth/MediaWikiShibboleth_body.php';
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createtalk'] = false;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['*']['writeapi'] = false;
If you want to allow anonymous editing, you should not add the last 4 lines of the previous paragraph. Though this really defeats the purpose of the extension.
Configuration
MediaWikiShibboleth has 3 configuration options which allow for restricting who can log in to your wiki. These options work especially well with restricting the access of the wiki to logged-in users only. They can be configured in the <mediawiki installation folder>/extensions/MediaWikiShibboleth/extension.json file.
Restricting access to logged-in users only
This option is not an option provided by the extension, but very useful in its context. If you do not want guest visitors to be able to view any page of your wiki, add the following line to your <mediawiki installation folder>/LocalSettings.php:
$wgGroupPermissions['*']['read'] = false;
MWSStudentsOnly
This option tells MediaWikiShibboleth to only allow students to log in. KU Leuven employees, alumni, doctoral students, teaching assistants etc. will not be able to log in using their employee account. Do keep in mind doctoral students also have a student account, which will still work. Set this option by adding
$wgMWSStudentsOnly = true;
to <mediawiki installation folder>/LocalSettings.php. If you combine this option with "Restricting access to logged-in users only", only students will be able to view, log in and edit your wiki.
MWSAllowedKULids
This option can be used to only allow specific KUL ids to log in. An example KUL id is "r0653730". If this option is set to "", no KUL id checking will be performed. Set this option by adding
$wgMWSAllowedKULids = "r0653730, r0300342, KUL id 3...";
to <mediawiki installation folder>/LocalSettings.php. You can add as many KUL ids as you like, separated by a comma.
MWSAllowedDegrees
This option can be used to only allow persons enrolled in specific degrees/programmes to log in. An example KUL degree number is "51016742". If this option is set to "[]", no degree number checking will be performed. Set this option by adding
$wgMWSAllowedDegrees = "51016742, 51016835, 51016753...";
to <mediawiki installation folder>/LocalSettings.php. You can add as many degree numbers as you like, separated by a comma.
Operation
When the extension is installed successfully, anonymous users will not be able to create an account and the account creation page will be removed from the home page. On the log in page, a new image is added: if you click on this image, you will be logged in using Shibboleth. If you want to log in with an explicit username/password combination, you can click "Password Login" to expand a login menu.
The new log in page looks like this with "Password Login" expanded:
Creating accounts
If you want to create password accounts, you can navigate to the CreateAccount special page (make sure you are logged in using an administrator account). This is necessary to create accounts for users without a KU Leuven login. You should select "Use a temporary random password and send it to the specified email address".
